Reviews Feed CVE-2026-10724

Exploitation requires all of the following: the target WordPress site must have the Reviews Feed plugin installed in a version before 2.6.5; the plugin must have at least one third-party review source actively connected and configured to ingest reviews; and the attacker must be able to post a review on that connected source platform (e.g., hold or create a Google account that can post to the linked business listing). The requirement to post on a specific connected third-party platform is the primary limiting factor, reflected in CVSS AC:H. CVSS PR:N confirms no account or privileges on the WordPress site itself are required. The impact ceiling is further limited by which WordPress shortcodes are registered on the target installation - a site with no powerful shortcodes registered will experience only benign execution. Exploitation is not possible if: the plugin has no connected review sources, the connected source platform does not permit review posting by the attacker's account, or no pages on the site render the affected dynamic block.

The NVD CVSS 3.1 score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects the indirect attack path: AC:H captures the prerequisite of posting a review on the connected third-party platform, which is not trivially controlled for all targets. PR:N on the WordPress site itself is confirmed by the CVSS vector - no account on the target is needed. The C:L/I:L impact metrics are conservative floor estimates; actual impact is variable and potentially higher depending on registered shortcodes at the target installation, a nuance CVSS cannot express without site-specific context. The publicly available POC (per WPScan) is a meaningful risk amplifier that the base score does not reflect. No EPSS data was provided; the absence of a CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis, though the public POC and ease of review-platform access for many businesses make targeted opportunistic exploitation realistic. This vulnerability warrants prompt patching for any internet-facing WordPress site with the plugin installed and a connected review source, despite the moderate base score.

An attacker identifies a WordPress site using the vulnerable Reviews Feed plugin and determines it is connected to a Google Business profile by inspecting the feed on the site. The attacker creates or uses a Google account to post a review on the linked business containing an embedded WordPress shortcode payload such as [contact-form-7 id=1] or a more impactful shortcode registered by another plugin on the site. Once the plugin ingests the review, any visitor loading the page with the reviews feed block triggers server-side shortcode execution - no interaction by the attacker after planting is required. A publicly available proof-of-concept from WPScan confirms this attack path is reproducible.